CVE-2017-1001000

WordPress Core < 4.7.2 - Arbitrary Page Modification

2017-01-26 00:00
Marc-Alexandre Montpas

Strategic Overview

Status
Patched in 3.7.18
Affected Core
WordPress 4.7
Affected Version
3.7 – 4.7.1 · 12 branches
CVSS
7.3High
Weakness type
CWE-285 · Improper Authorization
CVE
CVE-2017-1001000
View all WordPress 4.7 vulnerabilities

At a glance

CVE-2017-1001000 is a high-severity Improper Authorization vulnerability in the WordPress 4.7 WordPress release line, affecting 3.7 – 4.7.1 · 12 branches. It carries a CVSS score of 7.3 (reachable over the network; low attack complexity; high confidentiality, availability impact). The issue is fixed in version 3.7.18; sites on affected versions should update now. Disclosed January 2017, reported by Marc-Alexandre Montpas.

Vulnerability Overview

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed. A successful exploit has high impact on confidentiality, availability.

CWE-285: Improper Authorization

Reaching this weakness in WordPress 4.7 3.7 – 4.7.1 · 12 branches takes a caller who can reach the endpoint. Improper authorization means a permission check exists but does not cover the case being exercised, so a caller who is allowed to do one thing is allowed to do a neighbouring thing as well.

A lower-privileged account performs an action reserved for a higher one, which on a multi-author or membership site means an ordinary user reaching administrative behaviour. For WordPress 4.7 the fix is 3.7.18: builds 3.7 – 4.7.1 · 12 branches are affected, anything from 3.7.18 onward is not.

Remediation

Update to one of the following versions, or a newer patched version: 3.7.18, 3.8.18, 3.9.16, 4.0.15, 4.1.15, 4.2.12, 4.3.8, 4.4.7, 4.5.6, 4.6.3, 4.7.2

How does WordSec protect against this?

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: updating to 3.7.18 is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2017-1001000https://www.wordfence.com/threat-intel/vulnerabilities/id/2481f37b-a220-435d-9b43-6e7c5f42034fhttps://nvd.nist.gov/vuln/detail/CVE-2017-1001000

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C